openid-client 4.7.2 → 4.7.3

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [4.7.3](https://github.com/panva/node-openid-client/compare/v4.7.2...v4.7.3) (2021-04-30)
+
+
+### Bug Fixes
+
+* **fapi:** validate ID Token's iat regardless of which channel it came from ([b68b9ab](https://github.com/panva/node-openid-client/commit/b68b9ab5af6a85a2f42adf6b782cef7e08378658))
+
 ## [4.7.2](https://github.com/panva/node-openid-client/compare/v4.7.1...v4.7.2) (2021-04-23)
 
 

package/lib/client.js

@@ -724,6 +724,8 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
       });
     }
 
+    const fapi = this.constructor.name === 'FAPIClient';
+
     if (returnedBy === 'authorization') {
       if (!payload.at_hash && tokenSet.access_token) {
         throw new RPError({
@@ -739,19 +741,7 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
         });
       }
 
-      const fapi = this.constructor.name === 'FAPIClient';
-
       if (fapi) {
-        if (payload.iat < timestamp - 3600) {
-          throw new RPError({
-            printf: ['JWT issued too far in the past, now %i, iat %i', timestamp, payload.iat],
-            now: timestamp,
-            tolerance: this[CLOCK_TOLERANCE],
-            iat: payload.iat,
-            jwt: idToken,
-          });
-        }
-
         if (!payload.s_hash && (tokenSet.state || state)) {
           throw new RPError({
             message: 'missing required property s_hash',
@@ -773,6 +763,16 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
       }
     }
 
+    if (fapi && payload.iat < timestamp - 3600) {
+      throw new RPError({
+        printf: ['JWT issued too far in the past, now %i, iat %i', timestamp, payload.iat],
+        now: timestamp,
+        tolerance: this[CLOCK_TOLERANCE],
+        iat: payload.iat,
+        jwt: idToken,
+      });
+    }
+
     if (tokenSet.access_token && payload.at_hash !== undefined) {
       try {
         tokenHash.validate({ claim: 'at_hash', source: 'access_token' }, payload.at_hash, tokenSet.access_token, header.alg, key && key.crv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openid-client",
-  "version": "4.7.2",
+  "version": "4.7.3",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
   "keywords": [
     "auth",